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Party i ' s cryptography 
device generates a 
correct signature E for 
message m and transmits E 
to party j's cryptography 
device . _ _ 



Party i's cryptography ] 
device generates ^ ^ 
incorrect signature E for : 
the same message m and 
transmits E to party j's 
cryptography device. 



j (Party j ' s cryptography 
i— i ^device receives E and 
'stores it in memory . 



f Party j ' s cryptography 
y device receives E and 
I stores it in memory. 



T'Party 3 r s cryptography \ 
' device determines 

jgcd(E-E, N)=q. 1 



Having determined q, 
party j's cryptography 
device determines N. 
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Party i's cryptography 
device generates 
erroneous signature E for 
known message m (i.e., 
message m is generated 
without padding or with 
non - random jpadding ) and 
transmits E to party j's 
cryptography device. 



Party j 



Party j's cryptography j 
device receives E. i 



I Party j's cryptography 
i device determines 



i 



gcdtM-B^, N) = g. 



Having determined q, 
j party j's cryptography 
I device determines N. 
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| Party i's cryptography 
| device selects a random 
: r, generates r 2 mod N, 
[ and transmits this value 
j to party j's cryptography 
\ device . 



Party j ' s cryptography 
f device observes the value 
r 2 mod N. 



Party j' s cryptography 
device generates a 
random subset 
S s (1, . . . , t) and 
transmits S to party i's 
cryptography device^ 



While waiting to receive 
S from party j's device, 
a value in party i's 
device is inverted. 
After receiving S from ' 
party j's device, party 
i's device generates 
y= (r+£)n Ua Si j 
Party i ' s device 
transmits y to party j's] 
device . 
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\ determines E by 
! an E satisfying 
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f This is possible because 
£ =2 k for some lsksn 



Party j ' s 

device may determine r 
using : 
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(r+£) 2 -r 2 = 
2&r+£ 2 (mod 



Party j may use r to 
determine using: 
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-r 2 +£ 2 



r ^ - - r 

i Party j's cryptography 

j device determines 

l n^sSi/.for various sets U- 

\ construced as either (1) 

. singleton sets or (2) 

! selected at random such 
that resulting 

i characteristic vectors; 

! are linearly indepe nden t . 

tf's l'n'g t he sets; 
constructed above, party 
j's device performs the= 
Fiat - Shamir 
, authentication scheme, 
I providing the sets to 
party i ' s de vice . 

.:. 

Using the response to the 
sets sent to party i's 
device, party j 
determines the secret 
values s 1 , . . . , s t . 
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